Cyber threat intelligence sharing: Survey and research directions

Abstract

Cyber Threat Intelligence (CTI) sharing has become a novel weapon in the arsenal of cyber defenders to proactively mitigate increasing cyber attacks. Automating the process of CTI sharing, and even the basic consumption, has raised new challenges for researchers and practitioners. This extensive literature survey explores the current state-of-the-art and approaches different problem areas of interest pertaining to the larger field of sharing cyber threat intelligence. The motivation for this research stems from the recent emergence of sharing cyber threat intelligence and the involved challenges of automating its processes. This work comprises a considerable amount of articles from academic and gray literature, and focuses on technical and non-technical challenges. Moreover, the findings reveal which topics were widely discussed, and hence considered relevant by the authors and cyber threat intelligence sharing communities.

A Comparative Analysis of Cyber-Threat Intelligence Sources, Formats and Languages

“…Although mainly concerned with STIX 1.x as a solution for sharing CTI, Serrano, et al [23] highlighted several areas of importance in the context of CTI sharing. These include the legal and privacy implications in sharing CTI across borders and jurisdictions (also the focus in [24] and [25]), which have recently received great attention due to the general data protection regulation (GDPR), the requirement of a critical mass for CTI sharing sources that characterises its effectiveness, along with the belief that the main impediment to security data sharing is the lack of a suitable platform that addresses the issues of formats and legal boundaries for CTI data. Practices in sharing CTI were also studied in [26], where the results obtained from an online survey were used to classify potential barriers (and benefits) into areas such as operational, organisational, economic and policy; the quality and accuracy of CTI; the risk of privacy violation; the redundancy/relevancy of CTI; and the infrastructure costs were identified as the primary barriers.…”

DEALER: decentralized incentives for threat intelligence reporting and exchange

“…In this context, Liu et al [10] showed that a lack of incentives can even prevent the exchange process from happening. In addition to this, Wagner et al [11] pointed out the risks that are associated with sharing CTI, which in turn may prevent companies from participating in the exchange, which in the worst case can even lead to the information exchanged being used to attack participants in the exchange.…”

“…The source code for the prototype can be downloaded at the project repository. 10 A live version of the DApp is available online, 11 and the deployed EOS contract can be inspected on the EOS Kylin testnet. 12…”

Distributed Security Framework for Reliable Threat Intelligence Sharing

“…ere are multiple recent surveys [3,8] that review the current state of the art on cyber threat intelligence (CTI) sharing, defining associated benefits and barriers [9]. ese works highlight that security, trustworthiness, provenance, and privacy issues are still open research challenges in CTI sharing, in the sense that they have not been holistically addressed in the literature.…”